-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 30 Mar 2026 16:52:10 +0200 Source: inetutils Binary: inetutils-ftp inetutils-ftp-dbgsym inetutils-ftpd inetutils-ftpd-dbgsym inetutils-inetd inetutils-inetd-dbgsym inetutils-ping inetutils-ping-dbgsym inetutils-syslogd inetutils-syslogd-dbgsym inetutils-talk inetutils-talk-dbgsym inetutils-talkd inetutils-talkd-dbgsym inetutils-telnet inetutils-telnet-dbgsym inetutils-telnetd inetutils-telnetd-dbgsym inetutils-tools inetutils-tools-dbgsym inetutils-traceroute inetutils-traceroute-dbgsym Architecture: armel Version: 2:2.4-2+deb12u3 Distribution: bookworm-security Urgency: high Maintainer: arm Build Daemon (arm-ubc-04) Changed-By: Guillem Jover Description: inetutils-ftp - File Transfer Protocol client inetutils-ftpd - File Transfer Protocol server inetutils-inetd - internet super server inetutils-ping - ICMP echo tool inetutils-syslogd - system logging daemon inetutils-talk - talk to another user inetutils-talkd - remote user communication server inetutils-telnet - telnet client inetutils-telnetd - telnet server inetutils-tools - base networking utilities (experimental package) inetutils-traceroute - trace the IPv4 route to another host Closes: 1130741 1130742 Changes: inetutils (2:2.4-2+deb12u3) bookworm-security; urgency=high . * Add patch from upstream: - Prevent privilege escalation via telnetd abusing systemd service credentials support added to the login(1) implementation of util-linux in release 2.40. Reported by Ron Ben Yizhak . Fixes CVE-2026-28372. - Ignore all environment options from clients unless the variable was listed in the new --accept-env telnetd option. This mitigates privilege escalation using environment variables. This is the complete fix for CVE-2026-24061, with its own CVE pending. - Fix stack buffer overflow processing SLC suboption triplets. Reported by Adiel Sol, Arad Inbar, Erez Cohen, Nir Somech, Ben Grinberg, Daniel Lubel at DREAM Security Research Team. Fixes CVE-2026-32746. (Closes: #1130742) * Add the hashcode-string1 module from forky/sid gnulib adapted to bookworm required by the --accept-env patch, and the gl_hash_set, gl_set, gl_xset and gl_anyhash bookworm gnulib modules required by hashcode-string1. Inject new gnulib modules in lib/Makefile.am. * Adapt netkit-telnet patch to not leak unexported environment variables to telnetd. Reported by Justin Swartz . Fixes CVE-2026-32772. (Closes: #1130741) * Prevent user local privilege escalation using --debug, which was susceptible to symlink attacks, or leaking on-wire credentials to a user that had pre-created the file and kept it open. Fix by switching from /tmp/telnet.debug to /run/telnet/debug., and making the setup error checks fatal. Partially reported by Justin Swartz . * Update local telnetd man page to match new --debug behavior. Checksums-Sha1: 70503e731d99d0c37f976599baae832e6c7214f5 152220 inetutils-ftp-dbgsym_2.4-2+deb12u3_armel.deb 720a124b096c5134439fdd18edade8c172259ac5 101360 inetutils-ftp_2.4-2+deb12u3_armel.deb a1cce718f3d1d1139eafc40321ecbac01aafd1d4 184224 inetutils-ftpd-dbgsym_2.4-2+deb12u3_armel.deb 058e658dbf44ad3e519373f2f82011d1d073f5c7 102584 inetutils-ftpd_2.4-2+deb12u3_armel.deb 74a078182ee3e95d58d4673f224f37cd7446066e 102100 inetutils-inetd-dbgsym_2.4-2+deb12u3_armel.deb d07cba205b8ce5dca6f497bf260d4636dec48324 76296 inetutils-inetd_2.4-2+deb12u3_armel.deb a12ce4e4b134383f1eef53efd649ea00923315b3 178496 inetutils-ping-dbgsym_2.4-2+deb12u3_armel.deb 0e36c4c50aeaea55868cbe98be501c16c4f22560 81664 inetutils-ping_2.4-2+deb12u3_armel.deb 9e7ccc50480c4ddd6ba41e53f177337cf7c2fdc8 107720 inetutils-syslogd-dbgsym_2.4-2+deb12u3_armel.deb e2ab919dce0c562ae4dc4cea667b2f00fc94d688 79064 inetutils-syslogd_2.4-2+deb12u3_armel.deb 74c569484e4a0a3b71f206bafe64ba8b3fbc4e49 83948 inetutils-talk-dbgsym_2.4-2+deb12u3_armel.deb 9886c1a9bc2b3fd1d041d969c782c8523abcd602 65784 inetutils-talk_2.4-2+deb12u3_armel.deb ecf3effa8d15c628857f7bf583180dc6e26fddd9 98156 inetutils-talkd-dbgsym_2.4-2+deb12u3_armel.deb 78c87f83e94eab2bcef264168e9728c567a4f711 67616 inetutils-talkd_2.4-2+deb12u3_armel.deb 6d12b21af394234c6cd639ce09a1e67b635293e4 200096 inetutils-telnet-dbgsym_2.4-2+deb12u3_armel.deb c1ccb3b14c16ee4342b37a2b57647f3abb096b22 109672 inetutils-telnet_2.4-2+deb12u3_armel.deb 0edc18a30e64c19ac23f7aec05f26d5eb0dc79bc 178004 inetutils-telnetd-dbgsym_2.4-2+deb12u3_armel.deb 0c851ddd9fe77f2b2d786eb165d9931685633e2c 98528 inetutils-telnetd_2.4-2+deb12u3_armel.deb 56761473a7732e7e8893a27ee91b4fba2efdd0aa 312752 inetutils-tools-dbgsym_2.4-2+deb12u3_armel.deb 68f1817c7a3fc149ffbcff95b8e75642bb789d49 89460 inetutils-tools_2.4-2+deb12u3_armel.deb 622c65be3bd69b95b6136dde4320d81e9f2b7f4a 83628 inetutils-traceroute-dbgsym_2.4-2+deb12u3_armel.deb ad476da7e505673d520c4b091def5904050b64f2 64892 inetutils-traceroute_2.4-2+deb12u3_armel.deb 942e241dee4e1b4dc159fe372099ad5010e626fb 12991 inetutils_2.4-2+deb12u3_armel-buildd.buildinfo Checksums-Sha256: 2b12f10d15d38200f4fa1fb5195a40828d21b61a6ccf0a4970b1abdf6f3db88c 152220 inetutils-ftp-dbgsym_2.4-2+deb12u3_armel.deb 2678e138439ee96bcc0aacb6f641580ab583fcb966be1620dcb79867baf83253 101360 inetutils-ftp_2.4-2+deb12u3_armel.deb ee297a38c60c9912a7d61e3bb10f036104b9ab300e1488d790d0c076dd19fc1a 184224 inetutils-ftpd-dbgsym_2.4-2+deb12u3_armel.deb 43534bc71db0f07a3db6831a908ebfa77690be6e9ece339aa69e87706a794ca3 102584 inetutils-ftpd_2.4-2+deb12u3_armel.deb 40e7786dba6287e789a68c590fc4b20c2a8a8926419ffb74034198a98e6605e3 102100 inetutils-inetd-dbgsym_2.4-2+deb12u3_armel.deb 8ab4448ebe3d059cf22c97b4d320cedea0e8a79cae9163d6b93002e62e613c91 76296 inetutils-inetd_2.4-2+deb12u3_armel.deb a225b16c2ddd65ab6e774ce5b419211ad1ea33ed6f9bac5d80f39f90126a97a6 178496 inetutils-ping-dbgsym_2.4-2+deb12u3_armel.deb de91ca303e02edf84929282f90b08f56c42615b6a731d6a424d6089cceaa7fc4 81664 inetutils-ping_2.4-2+deb12u3_armel.deb 94f26c69a87b61c8a41e71f7b10e59bbacdc9f6e4ead849c35bdccfcfd1b83fe 107720 inetutils-syslogd-dbgsym_2.4-2+deb12u3_armel.deb a10e37efb5baffdc2d6ae025dd6cbb70cf63eb3f29f5ff10bd06470d746412b5 79064 inetutils-syslogd_2.4-2+deb12u3_armel.deb df4c847d305516bccafe9b479e8081223a93dba9e619a36694c36d8dc7e1880d 83948 inetutils-talk-dbgsym_2.4-2+deb12u3_armel.deb 9cd69a08d2437195c87464d9ca9b0fba3d842bc0e2154e9b5b46b8e9895e3c8f 65784 inetutils-talk_2.4-2+deb12u3_armel.deb 6aa3921918121175aba3ec0635feba668ef47221c8ef9d3d934d99675758cfdb 98156 inetutils-talkd-dbgsym_2.4-2+deb12u3_armel.deb 1cd242ddbc6c845a8e05351cac0ab98dde5239ce7c631e8d7584c90dae4ec293 67616 inetutils-talkd_2.4-2+deb12u3_armel.deb 5670791f2e6bfd1c997b92cbbea74145c80f0373936624a700ea83ff852a8dc4 200096 inetutils-telnet-dbgsym_2.4-2+deb12u3_armel.deb c2eaec7c1ddcce708a1a07da1343264c1074090e0f0163fef2e2f83e4113698f 109672 inetutils-telnet_2.4-2+deb12u3_armel.deb 311c71fb93a2c0fcca4f4cb88acbf7e1ec10e9239c2651f24cfcfd4570ef1366 178004 inetutils-telnetd-dbgsym_2.4-2+deb12u3_armel.deb 248797afb99082ab5b60ad414b2fcf45ae809b6cf9c6a09b8fd0b6785cf1a03a 98528 inetutils-telnetd_2.4-2+deb12u3_armel.deb 42288de67effdcd3647d638b1e931906edf41358c116a5b9924eef4cf0e1ebcd 312752 inetutils-tools-dbgsym_2.4-2+deb12u3_armel.deb 4292c7a6d92bd64ee0ee3938e12601b3b35c1f6357e775300644760ac9c55918 89460 inetutils-tools_2.4-2+deb12u3_armel.deb 5f822ebb31b5bfee95f0b0825117cc014be279997deecfed28b9bbd2335d91d6 83628 inetutils-traceroute-dbgsym_2.4-2+deb12u3_armel.deb b34279fd76333e99a1c63030fec268abedc779637ea87f18f39b1de175f298eb 64892 inetutils-traceroute_2.4-2+deb12u3_armel.deb ff724e0a13ac262dbf2b400776be48b18afb019e3e7a1d41870e131169a01e0d 12991 inetutils_2.4-2+deb12u3_armel-buildd.buildinfo Files: a53b0044e53325bde6eb73b91bddea12 152220 debug optional inetutils-ftp-dbgsym_2.4-2+deb12u3_armel.deb 015c3d34d8839acc9fa345abbc1d0ee6 101360 net optional inetutils-ftp_2.4-2+deb12u3_armel.deb bbdde878ba826b33c6f31f18a4075242 184224 debug optional inetutils-ftpd-dbgsym_2.4-2+deb12u3_armel.deb 0de81ec88f6552423c2588576750273a 102584 net optional inetutils-ftpd_2.4-2+deb12u3_armel.deb f6d1bbc9ccfde60abf20309230aa8d33 102100 debug optional inetutils-inetd-dbgsym_2.4-2+deb12u3_armel.deb 5766ebcf757bc50cb403cdad82515a00 76296 net optional inetutils-inetd_2.4-2+deb12u3_armel.deb 6a3152885256a37b18a004b40663c014 178496 debug optional inetutils-ping-dbgsym_2.4-2+deb12u3_armel.deb 9372cc4a1aa82b4a4d91ccad21cdc111 81664 net optional inetutils-ping_2.4-2+deb12u3_armel.deb e8b55f407f996d29b88c356950732a4b 107720 debug optional inetutils-syslogd-dbgsym_2.4-2+deb12u3_armel.deb 7d4672a8c6fca0a0aab5db464e47b886 79064 net optional inetutils-syslogd_2.4-2+deb12u3_armel.deb e2c9248bf1ff14f729593db450aaa7de 83948 debug optional inetutils-talk-dbgsym_2.4-2+deb12u3_armel.deb c239e39e97b26e15b0b6d4837cf8f0df 65784 net optional inetutils-talk_2.4-2+deb12u3_armel.deb 1a9c5cbe1985522ad4f7c498a9a126c0 98156 debug optional inetutils-talkd-dbgsym_2.4-2+deb12u3_armel.deb cca3b7f92054ffa4031d96374f6a3153 67616 net optional inetutils-talkd_2.4-2+deb12u3_armel.deb 028368fe275ee10ab017079cb5b5f704 200096 debug optional inetutils-telnet-dbgsym_2.4-2+deb12u3_armel.deb 7620622d0cbb9aaef0b9541e7ef61746 109672 net standard inetutils-telnet_2.4-2+deb12u3_armel.deb 575ddb993cf37d45aeffb70b954f6f9a 178004 debug optional inetutils-telnetd-dbgsym_2.4-2+deb12u3_armel.deb 802efd4225f1a2ffe9fc60dd18c371d4 98528 net optional inetutils-telnetd_2.4-2+deb12u3_armel.deb d8c0f41aa0983ab12d1f7a658ceda7b0 312752 debug optional inetutils-tools-dbgsym_2.4-2+deb12u3_armel.deb b5cb3bd42f05510073c624b30fde46e4 89460 net optional inetutils-tools_2.4-2+deb12u3_armel.deb db2aefcf882b6cb2dd25d2de66306fec 83628 debug optional inetutils-traceroute-dbgsym_2.4-2+deb12u3_armel.deb 552c3684a783aa2fa29e8db37f089341 64892 net optional inetutils-traceroute_2.4-2+deb12u3_armel.deb 702eea823951e8e47768cf19f72ef9e2 12991 net optional inetutils_2.4-2+deb12u3_armel-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEUPFH3FhY8nQZGtLwVLd4YzMSDKEFAmnL2+oACgkQVLd4YzMS DKFGdQ/+MJOm2ZkNeCJJI+ofD5h+o4AUnygPB3k6U0VKwwmZu6JCosGb2Y04QwYs qgi1t6tBbVRMidD925v9MF4MLV1dHkpaW4bmh/gjVPARSzlXnEi8ccWVNwWzTRbf jUjSJ6V+8YDKel7dAbOT70fAjzNmvySBUHvloazzrEMSZuSp8ymtzKsh5xiPPheC Wki+kbd+Gm6BAuwkelbqqLQYx/5NHpeFsL/j0YL6g2QjPXB1L4WJugquScyrytdD Q7B0pYuAZaxIOJ8yjx3DocNm/jLhC/mNQFv3kj2fsV3LChHsfPJ7hO9jcuI1rHk5 Lslv9BGgXyUl+NgDFbxpNd+/LC6RSTVXy15gjpUbunwFpTHkMgcWa/hOW53opO1Y Z5Af3a01tuz9md7zQ61i37Szg+rWEhUe/KeUW00PICyJ6euoN6/2xeIho70UJxGo i9gLgZpGvomF8D6cwJOcbEJM2vP3O6xhbrVU4VDw4yqAjov4KgarQUBJzJBmjD7a 1JZ5aYyTd7aOP2ISHDfPBLShRiiyoRnHYjz0/mnUo3jGuVCV6j5yIN7tvmgdRKhv aO26jhq4cwqfDhg+AsapKlsRHc9/g7OwkOhwLqiPa3TeFcSuup8ZIGBykvmLwLss WHugyzV4F9yKuYitUufrwXvpVPmIKCbxuxrcuxT9qN+3wRUNJB8= =7q99 -----END PGP SIGNATURE-----